WMI Sandbox Fingerprinting via Combined Win32_DiskDrive/VideoController Queries

Duo Tech@duotech

•updated Aug 17, 2026•0•0•5

Detects sandbox/VM fingerprinting via combined Win32_DiskDrive and Win32_VideoController WMI queries from the same process/host within a short window — anti-analysis behavior observed in the ACRStealer AutoIt payload prior to execution.